CVE-2026-115723: Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Snap7 through 1.4.3 in passive-partner mode are exposed when they use BRecv or CheckAsBRecvCompletion and accept a connection from the configured peer address. Affected processes include SCADA, HMI, and gateway applications that provide application buffers for received data.
What does an attacker need to exploit the vulnerability?
The attacker must be able to connect as the configured peer address and act as the active partner. They can declare a BSend total length of up to 65535 bytes while sending only a short fragment, triggering a memcpy beyond the application buffer.
What is the likely impact of successful exploitation?
The out-of-bounds write can crash the affected process or corrupt its memory. The provided severity vector indicates impacts to integrity and availability, with no stated confidentiality impact.
What can be done if updating is not immediately possible?
Restrict connectivity so that only the legitimate configured peer can reach the passive-partner service, and prevent untrusted systems from impersonating that peer address. This reduces the ability of a malicious active partner to establish the required connection.